build(ci): cap macOS build parallelism + wire shared sccache/Depot compiler cache

Two complementary fixes for the macOS build, behind a new `use_cache`
workflow_dispatch input (default true). Phase 1 = macOS only.

BUILD_JOBS knob (previously investigated, never landed): build.sh now honors
$BUILD_JOBS for the cmake -j level (default = all cores; portable nproc/sysctl
detection), and the 3 macOS build jobs set BUILD_JOBS=2. GitHub's ~7 GB macOS arm64
runners OOM under -j$(nproc) when the 16.6k-line httplib.cpp co-schedules with the model
TUs; the runner is then killed as SIGTERM/143 ("received a shutdown signal") — not a
real timeout. Capping concurrent compiles bounds peak memory.

sccache -> Depot Cache (WebDAV): build.sh routes the compiler through sccache
(-DCMAKE_*_COMPILER_LAUNCHER) only when USE_CACHE=true AND sccache + a cache token are
present, then prints `sccache --show-stats`. The 3 macOS jobs brew-install sccache and
set SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev +
SCCACHE_WEBDAV_TOKEN=${{ secrets.DEPOT_TOKEN }}. Because llama.cpp is pinned, the ~280
upstream object files are content-identical every run, so a warm cache recompiles only
changed files — staying -O3, bit-identical and release-safe. Depot's cache is shared
across all branches, so every branch builds incrementally (and warm builds also cut the
macOS memory pressure further).

Safety: inert until the DEPOT_TOKEN secret exists and on fork PRs (secrets hidden) —
those just compile normally; the install step is continue-on-error and use_cache=false
forces a clean from-scratch build. build.sh gating verified locally across all four
cases (warm / Linux-untouched / no-token / explicit-off).

Phase 2 (later): dockcross Linux/Android/CUDA (needs the token + sccache binary passed
into the container), Windows, and the Linux-host test-cpp job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JdLpWD8nedY7LwNnHefZLF

Author: claude

.github/build.sh

@@ -6,5 +6,33 @@
 # SPDX-License-Identifier: MIT
 
 mkdir -p build
-cmake -Bbuild $@ || exit 1
-cmake --build build --config Release -j$(nproc) || exit 1
+
+# Build parallelism. Defaults to all cores; RAM-limited CI runners (notably GitHub's
+# ~7 GB macOS arm64) export BUILD_JOBS lower (e.g. 2) so the large httplib.cpp + the 134
+# llama.cpp model TUs do not exhaust memory and get the runner OOM-killed mid-compile
+# (which surfaces as a SIGTERM / "runner received a shutdown signal", not a clean timeout).
+JOBS="${BUILD_JOBS:-}"
+if [ -z "$JOBS" ]; then
+  JOBS="$( { command -v nproc >/dev/null 2>&1 && nproc; } || sysctl -n hw.ncpu 2>/dev/null || echo 4 )"
+fi
+
+# Optional shared compiler cache: sccache fronting Depot Cache (WebDAV). Enabled only when
+# USE_CACHE is true AND sccache + a cache token are present, so it stays inert before the
+# DEPOT_TOKEN secret is configured and on fork PRs (secrets hidden) — those just compile
+# normally. sccache is content-addressed, so a cache hit is bit-identical to a fresh -O3
+# compile (release-safe), and it degrades to direct compilation if the cache is unreachable.
+LAUNCH=""
+if [ "${USE_CACHE:-true}" = "true" ] && command -v sccache >/dev/null 2>&1 \
+   && [ -n "${SCCACHE_WEBDAV_TOKEN:-}${SCCACHE_GHA_ENABLED:-}" ]; then
+  LAUNCH="-DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache"
+  echo "build.sh: sccache ON (endpoint=${SCCACHE_WEBDAV_ENDPOINT:-default}), building with -j${JOBS}"
+else
+  echo "build.sh: sccache OFF, building with -j${JOBS}"
+fi
+
+cmake -Bbuild $LAUNCH $@ || exit 1
+cmake --build build --config Release -j"${JOBS}" || exit 1
+
+if command -v sccache >/dev/null 2>&1; then
+  sccache --show-stats || true
+fi

.github/workflows/publish.yml

@@ -15,6 +15,10 @@ on:
         description: "Deploy to Maven Central (snapshot if -SNAPSHOT, release if a vX.Y.Z tag)"
         type: boolean
         default: false
+      use_cache:
+        description: "Use the shared sccache/Depot compiler cache (faster incremental builds)"
+        type: boolean
+        default: true
 env:
   JAVA_VERSION: '21'
   MODEL_URL: "https://huggingface.co/TheBloke/CodeLlama-7B-GGUF/resolve/main/codellama-7b.Q2_K.gguf"
@@ -308,6 +312,11 @@ jobs:
     name: Build and Test macOS 15 arm64 (no Metal)
     needs: [startgate, build-webui]
     runs-on: macos-15
+    env:
+      BUILD_JOBS: 2
+      USE_CACHE: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
+      SCCACHE_WEBDAV_ENDPOINT: https://cache.depot.dev
+      SCCACHE_WEBDAV_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - uses: actions/checkout@v6
       - name: Download shared WebUI assets
@@ -327,6 +336,10 @@ jobs:
           echo ""
           echo "=== Processor Details ==="
           system_profiler SPHardwareDataType
+      - name: Install sccache (shared compiler cache)
+        if: env.USE_CACHE == 'true'
+        continue-on-error: true
+        run: brew install sccache
       - name: Build libraries
         shell: bash
         run: |
@@ -344,6 +357,11 @@ jobs:
     name: Build and Test macOS 14 arm64 (Metal)
     needs: [startgate, build-webui]
     runs-on: macos-14
+    env:
+      BUILD_JOBS: 2
+      USE_CACHE: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
+      SCCACHE_WEBDAV_ENDPOINT: https://cache.depot.dev
+      SCCACHE_WEBDAV_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - uses: actions/checkout@v6
       - name: Download shared WebUI assets
@@ -363,6 +381,10 @@ jobs:
           echo ""
           echo "=== Processor Details ==="
           system_profiler SPHardwareDataType
+      - name: Install sccache (shared compiler cache)
+        if: env.USE_CACHE == 'true'
+        continue-on-error: true
+        run: brew install sccache
       - name: Build libraries
         shell: bash
         run: |
@@ -476,6 +498,11 @@ jobs:
     name: Build and Test macOS 15 arm64 (Metal)
     needs: [startgate, build-webui]
     runs-on: macos-15
+    env:
+      BUILD_JOBS: 2
+      USE_CACHE: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
+      SCCACHE_WEBDAV_ENDPOINT: https://cache.depot.dev
+      SCCACHE_WEBDAV_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - uses: actions/checkout@v6
       - name: Download shared WebUI assets
@@ -495,6 +522,10 @@ jobs:
           echo ""
           echo "=== Processor Details ==="
           system_profiler SPHardwareDataType
+      - name: Install sccache (shared compiler cache)
+        if: env.USE_CACHE == 'true'
+        continue-on-error: true
+        run: brew install sccache
       - name: Build libraries
         shell: bash
         run: |